CVE-2025-8088: fallo de gravedad alta en win.rar GmbH WinRAR
Path traversal vulnerability in WinRAR
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
95Vexday Risk Score
Prioriza la corrección. Ella está bajo explotación confirmada por CISA y tiene prueba de concepto pública.
ssvc Actcvss 8.4epss 94%
de la publicación al armael mismo día
Publicada en NVD8 ago
1ª PoC26 may
CISA KEV+4d
Acción exigida por CISAplazo federal: 2025-09-02
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
En resumen
WinRAR en Windows tiene una falla que permite a los atacantes ejecutar código malicioso mediante archivos comprimidos especialmente diseñados. Al abrir estos archivos, el código del atacante puede ejecutarse en tu computadora.
Detalle técnico
Una vulnerabilidad de path traversal en WinRAR para Windows permite ejecución remota de código a través de archivos comprimidos maliciosos. La falla explota validación insuficiente de rutas durante la extracción, permitiendo que atacantes escriban y ejecuten código arbitrario; la vulnerabilidad ha sido explotada activamente en la naturaleza.
Resumen generado y traducido por IA a partir de la descripción oficial.
El análisis completo de esta CVE está disponible en portugués →
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepanov, Peter Košinár, and Peter Strýček
from ESET.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
win.rar GmbH · WinRARPoCs públicas encontradas — 58
githubgithub.com/sxyrxyy/CVE-2025-8088-WinRAR-Proof-of-Concept-PoC-Exploit-★ 71githubgithub.com/onlytoxi/CVE-2025-8088-Winrar-Tool★ 56githubgithub.com/knight0x07/WinRAR-CVE-2025-8088-PoC-RAR★ 46githubgithub.com/hexsecteam/CVE-2025-8088-Winrar-Tool★ 40githubgithub.com/pentestfunctions/CVE-2025-8088-Multi-Document★ 36githubgithub.com/aldisakti2/CVE-2025-8088-BUILDER-Winrar-Tool★ 28githubgithub.com/AdityaBhatt3010/CVE-2025-8088-WinRAR-Zero-Day-Path-Traversal★ 12githubgithub.com/pentestfunctions/best-CVE-2025-8088★ 10githubgithub.com/jordan922/CVE-2025-8088★ 10githubgithub.com/kitsuneshade/WinRAR-Exploit-Tool---Rust-Edition★ 8githubgithub.com/starfallreverie/winrar-exploit★ 8githubgithub.com/walidpyh/CVE-2025-8088★ 5githubgithub.com/lennertdefauw/CVE-2025-8088★ 5githubgithub.com/Syrins/CVE-2025-8088-Winrar-Tool-Gui★ 3githubgithub.com/undefined-name12/CVE-2025-8088-Winrar★ 2githubgithub.com/pexlexity/WinRAR-CVE-2025-8088-Path-Traversal-PoC★ 2githubgithub.com/travisbgreen/cve-2025-8088★ 2githubgithub.com/DeepBlue-dot/CVE-2025-8088-WinRAR-Startup-PoC★ 1githubgithub.com/Shinkirou789/Cve-2025-8088-WinRar-vulnerability★ 1githubgithub.com/0xAbolfazl/CVE-2025-8088-WinRAR-PathTraversal-PoC★ 1githubgithub.com/ilhamrzr/RAR-Anomaly-Inspector★ 1githubgithub.com/pescada-dev/-CVE-2025-8088★ 1githubgithub.com/ghostn4444/CVE-2025-8088★ 0githubgithub.com/IsmaelCosma/CVE-2025-8088★ 0githubgithub.com/techcorp/CVE-2025-8088-Exploit★ 0githubgithub.com/nhattanhh/CVE-2025-8088★ 0githubgithub.com/hbesljx/CVE-2025-8088-EXP★ 0githubgithub.com/shaheeryasirofficial/CVE-2025-8088★ 0githubgithub.com/xi0onamdev/WinRAR-CVE-2025-8088-Exploitation-Toolkit★ 0vulncheckvulncheck.com/xdb/00de97ba90c7no verificadovulncheckvulncheck.com/xdb/497fbf11e8deno verificadovulncheckvulncheck.com/xdb/6d512e0820d7no verificadovulncheckvulncheck.com/xdb/f64138d13478no verificadovulncheckvulncheck.com/xdb/78ed85fda27eno verificadovulncheckvulncheck.com/xdb/5da337bc5f89no verificadovulncheckvulncheck.com/xdb/9b534d3ef6c7no verificadovulncheckvulncheck.com/xdb/eb888ee6693fno verificadovulncheckvulncheck.com/xdb/3d258c7fae5ano verificadovulncheckvulncheck.com/xdb/c9ec17df3484no verificadovulncheckvulncheck.com/xdb/78b7ca6ea1dfno verificadovulncheckvulncheck.com/xdb/9d7c3c7fdd33no verificadovulncheckvulncheck.com/xdb/6f9c869c6fb9no verificadovulncheckvulncheck.com/xdb/55d1b6a61807no verificadovulncheckvulncheck.com/xdb/45645f7612e0no verificadovulncheckvulncheck.com/xdb/a844d0def670no verificadovulncheckvulncheck.com/xdb/1e4c37c73a41no verificadovulncheckvulncheck.com/xdb/154992e62e50no verificadovulncheckvulncheck.com/xdb/7650cf5a95abno verificadovulncheckvulncheck.com/xdb/34ba9124d782no verificadovulncheckvulncheck.com/xdb/cd3c4f37b48ano verificadovulncheckvulncheck.com/xdb/961835f2d3b8no verificadovulncheckvulncheck.com/xdb/1d051fb3ef28no verificadovulncheckvulncheck.com/xdb/30419eb3bb9fno verificadovulncheckvulncheck.com/xdb/292be7ae71cano verificadovulncheckvulncheck.com/xdb/0b2ca6f9f58ano verificadovulncheckvulncheck.com/xdb/f46f62569182no verificadovulncheckvulncheck.com/xdb/f7413bcb302fno verificadovulncheckvulncheck.com/xdb/ef3da8669a27no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/https://support.dtsearch.com/faq/dts0245.htmhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088https://www.vicarius.io/vsociety/posts/cve-2025-8088-detect-winrar-zero-dayhttps://www.vicarius.io/vsociety/posts/cve-2025-8088-mitigate-winrar-zero-day-using-srp-and-ifeohttps://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=283&cHash=a64b4a8f662d3639dec8d65f47bc93c5